from Crypto.Cipher import AES
import random
import hashlib

def solve_flag():
    enc_hex = "e88b2eb25b22929b2eb84898bc2c620c8798637ab64b892c218c83a0e523580f6c5772c84461f09045b6bce48c102a5f"
    check = "83d92dc441e420587b2eb46f46ca424597af97a88f0da1b64243e287c69aa645"
    ciphertext = bytes.fromhex(enc_hex)

    c0 = ciphertext[0:16]
    c1 = ciphertext[16:32]
    c2 = ciphertext[32:48]

    total_seeds = 75280
    for seed in range(total_seeds):
        if seed % 10000 == 0:
            print(f"Testing seed: {seed}/{total_seeds}")

        random.seed(seed)
        key = random.getrandbits(128).to_bytes(16, 'big')

        try:
            cipher_ecb = AES.new(key, AES.MODE_ECB)
            decrypted_c0 = cipher_ecb.decrypt(c0)

            iv_candidate = bytes([dc ^ 0x10 for dc in decrypted_c0])

            cipher_cbc = AES.new(key, AES.MODE_CBC, iv=iv_candidate)
            plaintext = cipher_cbc.decrypt(ciphertext)

            if plaintext[:16] == b'\x10' * 16:
                flag_candidate = plaintext[16:48]
                if hashlib.sha256(flag_candidate).hexdigest() == check:
                    print(f"\nFound valid seed: {seed}")
                    return flag_candidate.decode('utf-8')
        except Exception as e:
            continue

    return "Flag not found"

if __name__ == "__main__":
    flag = solve_flag()
    print("Decrypted Flag:", flag)
